0

I've been following a login system tutorial. You can find it here. There are 2 parts of coding C# and PHP. The C# part is working fine but my PHP part returning error. Here is my PHP code:

<?php

    $servername = getenv('IP');
    $username = getenv('C9_USER');
    $passwordp = "";
    $database = "game_database";
    $dbport = 3306;

    // Create connection
    mysql_connect($servername, $username, $passwordp, $dbport)or die("Cant Connect to server");
    mysql_select_db($database) or die("Cant connect to database");
    // Check connection


$Email = $_REQUEST["Email"];
$Password= $_REQUEST["Password"];

if (!$Email || !$Password){
    echo"Email or password must be used";
}
else{
    $SQL = "SELECT * FROM 'users' WHERE Email = '"  . $Email ."'";
    $result_id = @mysql_query($SQL) or die("Database Error");
    $Total = mysql_num_rows($result_id);
    if ($Total){
        $datas = @mysql_fetch_array($result_id);
        if (strcmp($Password, $datas["Password"])){
                    $sql2 = "SELECT Characters FROM users WHERE Email = '" . $Email ."'";
                    $result_id2 = @mysql_query($sql2) or die("Database Error!!!");
                    while ($row = mysql_fetch_array($result_id2)){
                        echo $row ["Characters"];
                        echo ":";
                        echo "Success";
                    }
        }
        else{
            echo "WrongPassword";
        }
        }else {
            echo "NameDoesNotExist";
        }
    }

?>

It seems the error comes from $result_id but I'm not sure?

4
  • 2
    I understand you are trying to do something with C#, but this question doesn't seem to be about C# at all, let alone Unity3D.
    – GolezTrol
    Jul 5, 2015 at 19:09
  • 2
    What is the error you are getting? This code is also open to SQL injections. Also you should suppress errors when debugging.
    – chris85
    Jul 5, 2015 at 19:11
  • 1
    About SQL injection: Allow me to introduce you to the story of little Bobby Tables. Now, as for the problem that you noticed, it would help to know what the error was. Also, it would really help to have a proper MCVE.
    – Dan Ross
    Jul 5, 2015 at 19:18
  • I get the error "Database Error" from the mysql_query in $result_id which comes from or die Jul 5, 2015 at 19:34

2 Answers 2

0

You are true, the error is from $result_id, because your SQL statement has problem and there are extra stuff to fix.

You have put users table in two single quotes, it is wrong.

Your code is:

$SQL = "SELECT * FROM 'users' WHERE Email = '"  . $Email ."'";

It should be with out quotes:

$SQL = "SELECT * FROM users WHERE Email = '"  . $Email ."'";

You have wrote:

if ($Total){

It should check how many users record found, typically it should find only 1 record and return 1, therefore change it to:

if ($Total == 1){

Note1: But when this is said, it does not mean the code is perfect, you should further develop your code to fulfill nowadays requirement. I would suggest you think of password hashing, use mysqli or PDO in sted of mysql and input sensitization. I would suggest you look at this link it describes some of the things I mentioned.

Note2: I was able to write you a total solution with mysqli/PDO etc, but I wanted only to point the errors I have catch so far in your code so you can learn from your mistakes and develop your self.

And in general read about security principles, check this page.

Link1: http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

Link2: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

2
  • when I register then login I get the error "Namedoesnotexist" from php script even though I have a table called users in game_database Jul 5, 2015 at 20:32
  • check the edited answer, put Characters back as it was and check that Characters exist in the table of users. Jul 5, 2015 at 21:22
0

This is another simple way where you can create user log in, it is more secure than the one you have at the moment. And you should protect your code from sql injections.

<?php
if (isset($_POST['email'], $_POST['password']) === true )
{
    require 'connection.php';

    $email = mysqli_real_escape_string($connection,$_POST['email']);
    $password = mysqli_real_escape_string($connection,$_POST['password']);

    $sql = "SELECT * FROM users WHERE email= '$email'";
    $result = mysqli_query($connection,$sql);

    if (mysqli_num_rows($result))
    {
        if( $email == $row['email'] && $password == $row['password'])
        {                         //use session to check if user is logged in
            if (!isset($_SESSION['loggedin'])) 
            {
                //you can set session of user's log in details
                //you can redirect to user profile
            } 
            else 
                //already log in, redirect to user profile
        }
        else 
            echo "Incorrect Email or Password.";
    }
    else
        echo "Incorrect Username or Password.";
    mysqli_close($connection);
}
else
{
    echo "Oops, something went wrong!";
?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.